Privacy Policy

This Privacy Policy explains how Supra Law (“we”, “us” or “our”) collects and processes personal data when you interact with us, use our website or engage us to provide immigration and legal services. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Finnish data protection legislation.

1. Data controller and contact details

The data controller responsible for the processing of your personal data is:

Supra Law
Finland

Email: info@suprafin.fi

If you have any questions about this Privacy Policy or our data protection practices, you can contact us using the above email address.

2. Personal data we collect

We primarily collect personal data that you provide directly to us. This includes, in particular, data you submit through contact forms on our website or when you communicate with us by email or phone.

Depending on your interaction with us, we may process the following categories of personal data:

  • Identification and contact details, such as your name and email address.
  • Communication and enquiry details, such as the content of your message, case description, and other information you choose to provide when you contact us.
  • Technical data related to website use, such as IP address, browser information and similar usage data, which may be collected automatically through our service providers (for example, for security, analytics and spam protection). This information is typically collected in a form that does not personally identify you, unless it is linked to other information you have provided.

In the course of providing legal services, we may also process additional personal data that you provide to us or that is obtained from third parties (for example, authorities or counterparties). Such processing is carried out in accordance with our obligations and duties as legal professionals and is covered by professional secrecy and confidentiality.

3. Purposes and legal bases for processing

We process your personal data only when we have a lawful basis under the GDPR. Depending on the context, we rely on the following legal bases:

  • Legitimate interest (Article 6(1)(f) GDPR): We process personal data based on our legitimate interests in operating, maintaining and developing our business, including:
    • responding to your enquiries and requests;
    • managing and improving our website and online services;
    • ensuring the security of our website and IT systems; and
    • protecting and exercising our legal rights.
  • Performance of a contract or taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR): When you become or are about to become our client, we process your personal data as necessary to:
    • assess whether we can accept your case;
    • provide immigration and legal services to you;
    • communicate with you about your matter; and
    • manage client relationships and billing.

Where required by law (for example, under anti-money laundering or accounting legislation), we may also process personal data to comply with our legal obligations (Article 6(1)(c) GDPR).

4. Data retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy or as required by applicable law.

  • Contact and enquiry data: Information submitted through contact forms or email enquiries that do not lead to an engagement is generally retained for up to 12 months, unless a longer retention period is necessary for the establishment, exercise or defence of legal claims.
  • Client and case files: If you engage us to provide immigration or legal services, we retain client and case-related data for the duration of the engagement and for a period thereafter as required or permitted by Finnish law and bar association guidance (for example, to comply with statutory retention periods and to handle potential claims).
  • Technical and log data: Data collected for security, maintenance and analytical purposes is retained for a limited period that is necessary for those purposes, typically in accordance with the retention practices of our service providers.

When personal data is no longer needed, we will securely delete or anonymise it.

5. Sharing of personal data and use of service providers

We do not sell your personal data to third parties. We only share personal data to the extent necessary for the purposes described in this Privacy Policy, and always in accordance with applicable data protection law.

We may share personal data with the following categories of recipients:

  • Service providers and processors: We use trusted third-party service providers to operate and secure our website and communications. This may include:
    • Jetpack / Automattic (and related services) for website functionality, performance, security and analytics.
    • Akismet (a service provided by Automattic) to detect and prevent spam in contact form submissions and comments.
    • Website hosting providers, email service providers and IT support services.
    These service providers may process personal data on our behalf under written data processing agreements.
  • Professional advisers and counterparties: When necessary for your matter, we may share information with other legal professionals, experts, authorities or counterparties, always in line with our professional obligations and your instructions.
  • Authorities: We may disclose personal data to courts, law enforcement or other public authorities where required by law or where it is necessary for the establishment, exercise or defence of legal claims.

Some of our service providers (such as Automattic, the company behind Jetpack and Akismet) may be located outside the European Economic Area (EEA). In such cases, we ensure that appropriate safeguards are in place as required by the GDPR (for example, the use of the European Commission’s standard contractual clauses), or that an adequacy decision applies.

6. Your rights under the GDPR

As a data subject, you have various rights under the GDPR in relation to your personal data, subject to the conditions and limitations set out in the law. These include:

  • Right of access: You have the right to obtain confirmation as to whether we process personal data concerning you and, if so, to receive a copy of your personal data and information about our processing.
  • Right to rectification: You have the right to request that inaccurate or incomplete personal data be corrected or completed.
  • Right to erasure: In certain circumstances, you have the right to request that we delete your personal data, for example where the data is no longer necessary for the purposes for which it was collected. This right may be limited where we have legal obligations or overriding legitimate interests to retain the data (for example, in connection with legal claims or professional record-keeping duties).
  • Right to restriction of processing: In certain situations, you may request that we restrict the processing of your personal data, for example while we are assessing a request for rectification or objection.
  • Right to data portability: To the extent that we process your personal data based on your consent or on a contract, and the processing is carried out by automated means, you have the right to receive the data you have provided to us in a structured, commonly used and machine-readable format and to have it transmitted to another controller where technically feasible.
  • Right to object: You have the right to object, on grounds relating to your particular situation, to the processing of your personal data that is based on our legitimate interests. We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defence of legal claims.

Where we process your personal data based on consent (if applicable), you also have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

7. How to exercise your rights

You can exercise your rights by contacting us using the contact details provided above (email: info@suprafin.fi). To help us process your request, we may need to verify your identity and ask for additional information.

We aim to respond to your request without undue delay and in any event within the time limits set by the GDPR.

8. Right to lodge a complaint

If you consider that our processing of your personal data infringes applicable data protection legislation, you have the right to lodge a complaint with a supervisory authority. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).

You can contact the Office of the Data Protection Ombudsman using the contact details available on its website: https://tietosuoja.fi.

9. Cookies and similar technologies

Our website uses cookies and similar technologies to ensure its proper functioning, to improve user experience and, in some cases, to collect statistics about the use of the site. Some cookies are necessary for the technical operation and security of the website, while others are used for analytics or to remember your preferences.

For detailed information about the types of cookies we use, the purposes for which we use them, and how you can manage your cookie preferences, please refer to our Cookie Policy.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect changes in our practices or in applicable law. The updated version will be published on our website and will indicate the date of the latest update.

This Privacy Policy was last updated on 9 August 2026.